Priority reviewCritical

CVE-2026-34156

nocobase

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist (controlled by WORKFLOW_SCRIPT_MODULES env var). However, the console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr. An authenticated attacker can traverse the prototype chain to escape the sandbox and achieve Remote Code Execution as root. This...

CVSS: 9.9
EPSS: 36.5%
CISA KEV: Not listed
Published: 2026.03.31

PRIORITY ASSESSMENT

Priority review

FIRST EPSS indicates an elevated probability of exploitation.

Known exploitationNot established by KEV

Exploit probability36.5%

Technical severityCVSS 9.9

Vulnerability overview

Affected product and versions

Product: nocobase
Affected versions: >= < 2.0.28, < 2.0.28
Fixed versions: 2.0.28

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that nocobase and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE: CWE-913